keep the import live across edits Maps are declared at package scope as a struct literal of one of the types in this file. The kind of map (array / ha

BloomFilter is a BPF_MAP_TYPE_BLOOM_FILTER. Bloom filters answer "have I seen X?" with no false negatives but possible false positives. They have no p

CgroupSkbReturn is the return type of a cgroup_skb program. The kernel treats 0 as "drop" and 1 as "allow"; everything else is reserved.

bpf:license GPL

CpuMap is a BPF_MAP_TYPE_CPUMAP: per-CPU dispatch for XDP redirect. Userspace pins each slot to a CPU plus an optional follow-up BPF program. Redirect

XDP redirect-target maps. These don't store user state; they tell the verifier that XDP_REDIRECT is allowed to point at the entries userspace populate

Diagnostic is a validator finding at a specific source position.

Diagnostics is a slice of diagnostics with a combined Error rendering.

bpf:license GPL Event is the tagged payload all event-driven programs publish to the ringbuf. Field layout uses only 4-byte-aligned types so Go's bina

bpf:license GPL

ExecveEnterCtx is the syscall-specific context for `tracepoint/syscalls/sys_enter_execve`. Each field is a userspace pointer (uint64) named after the

bpf:license GPL

HashMap is a BPF_MAP_TYPE_HASH.

HelperFunc is a top-level function without a //bpf:section directive. The emitter renders these as `static __always_inline` functions in C so callers

InodeStorage is a BPF_MAP_TYPE_INODE_STORAGE. Stores one V per `struct inode *`. Common in LSM hooks and file-related tracing.

KpReturn is the return type of kprobe / kretprobe / uprobe / uretprobe programs. The kernel ignores the value; convention is to return 0.

LpmTrie is a BPF_MAP_TYPE_LPM_TRIE. Longest-prefix-match lookups, useful for IP routing-style tables. The key type K must start with a `__u32 prefixl

LruHashMap is a BPF_MAP_TYPE_LRU_HASH. Behaves like HashMap but evicts the least-recently-used entry when full.

LruPerCPUHash is a BPF_MAP_TYPE_LRU_PERCPU_HASH.

LsmCtx is the context pointer passed to an LSM (Linux Security Module) BPF program. Renders as `void *` in the emitted C. LSM has ~200 hooks (file_op

LsmReturn is the return type of an LSM program. The kernel treats 0 as "allow" and any negative value as a denial (typically `-EPERM`, `-EACCES`, etc.

MapDecl is a BPF map declared at package scope. The map kind comes from the Go type (ArrayMap, HashMap, RingBuf, …); K and V from the generic type arg

OpenatEnterCtx is the syscall-specific context for `tracepoint/syscalls/sys_enter_openat`.

PerCPUArray is a BPF_MAP_TYPE_PERCPU_ARRAY. Each CPU has its own copy of every slot; kernel-side Lookup returns the current CPU's slot.

PerCPUHash is a BPF_MAP_TYPE_PERCPU_HASH. Like PerCPUArray but keyed by a hashable type instead of a 32-bit index.

PerfEventArray is a BPF_MAP_TYPE_PERF_EVENT_ARRAY: per-CPU perf event buffers used to deliver events to userspace. For new code prefer RingBuf — perf_

ProgArray is a BPF_MAP_TYPE_PROG_ARRAY: a uint32-indexed table of BPF program references, used for tail calls. Userspace populates entries with progr

Program is the intermediate representation produced by parsing a single gobee input file. The C emitter consumes this and writes BPF C.

ProgramFunc is a top-level function annotated with `//bpf:section`.

PtRegs is the context pointer for kprobe, kretprobe, uprobe, and uretprobe BPF programs. Renders as `struct pt_regs *` in the emitted C. pt_regs has

Queue is a BPF_MAP_TYPE_QUEUE — FIFO of T values.

Result describes one emitted artifact.

RingBuf is a BPF_MAP_TYPE_RINGBUF for delivering events from kernel to userspace. MaxEntries is the byte size of the ring (must be a power of 2, at le

RunOptions configures a single `gobee translate` invocation.

bpf:license GPL

SkBuff is the context pointer for TC (classifier/action) and cgroup_skb programs. Renders as `struct __sk_buff *` in the emitted C. Field access (e.g.

SkStorage is a BPF_MAP_TYPE_SK_STORAGE. Stores one V per `struct sock *`. Available in sock_ops, cgroup_skb, and tracing programs that get a sock poin

SockOpsMd is the context pointer for sock_ops BPF programs. Renders as `struct bpf_sock_ops *` in emitted C. `bpf_sock_ops` is a UAPI BPF program cont

SockOpsReturn is the return type of a sock_ops program. The kernel uses non-zero to mean "drop / abort" for some op variants and ignores it for others

bpf:license GPL

SourceMap is the in-memory shape of a `.bpf.c.map` file. Keys are emitted-C line numbers; values are Go positions formatted as `file:line:col`.

SourceMapping ties one line in the emitted C back to its originating Go source position. Used by `gobee diagnose` to rewrite verifier errors.

Stack is a BPF_MAP_TYPE_STACK — LIFO of T values.

SyscallEnterCtx is the typed context for syscall-entry tracepoints (`tracepoint/syscalls/sys_enter_*`). Renders as `struct trace_event_raw_sys_enter *

SyscallExitCtx is the typed context for syscall-exit tracepoints (`tracepoint/syscalls/sys_exit_*`). Ret is the syscall return value.

Per-object storage maps below. These keep one V per kernel object — task / socket / inode — and don't need MaxEntries (the kernel sizes the map dynami

TcAction is the return type of a TC classifier/action program.

TpReturn is the return type of a tracepoint program. Legacy tracepoints always return 0; non-zero values are reserved for future kernel use and are cu

TracepointCtx is the context pointer passed to a tracepoint BPF program. Renders as `void *` in emitted C because each tracepoint hook has its own aut

UserConstDecl is a package-level const declaration. The bindings emitter re-publishes these (capitalized) so userspace can reference the same values t

UserTypeDecl is a user-defined struct (e.g. a ringbuf event payload). The emitter renders these as `struct <Name> { ... };` in C.

bpf:license GPL

XdpAction is the return type of an XDP program; values map 1:1 to the kernel XDP_* constants.

XdpMd mirrors `struct xdp_md` from the Linux kernel. In transpiled C it becomes `struct xdp_md *`; field access (e.g. `ctx.IngressIfIndex`) is emitted

XskMap is a BPF_MAP_TYPE_XSKMAP: AF_XDP socket table for zero-copy userspace networking. Userspace pins each slot to an AF_XDP socket fd. Redirect(ctx

attachHelper describes one generated Attach<Name> method. Body uses the literal placeholder $PROG which is replaced with `o.<Field>` at emit time so t

bpfTypeInfo describes how a Go type from the bpf package maps to C. One entry per type. Adding a new bpf-package type = one row, no other places to up

Forward declarations of BPF structs */

directive is a parsed `//bpf:<name> [args...] [k=v ...]` comment.

helper is one parsed entry from bpf_helper_defs.h.